{"slug":"seat-continuity-and-handover","title":"seat-continuity-and-handover","summary":"Use when replacing a seat's occupant (rebuild/handover/swap), reasoning about stable-seat-identity vs fluid-occupant-identity, choosing an old-occupant disposition (retire/advise/shadow), or recording provenance for an occupant change. Two independent outcomes (continuityOutcome ","platform":"Claude","tags":[],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-08-31T16:20:55.934899Z","repo":{"url":"https://github.com/mvschwarz/openrig","stars":371,"forks":51,"license":"Apache-2.0","updatedAt":"2026-09-25T04:59:18Z"},"bodyHtml":"<hr>\n<h2>name: seat-continuity-and-handover\ndescription: Use when replacing a seat's occupant (rebuild/handover/swap), reasoning about stable-seat-identity vs fluid-occupant-identity, choosing an old-occupant disposition (retire/advise/shadow), or recording provenance for an occupant change. Two independent outcomes (continuityOutcome + seatBindingOutcome) and the 5 failure modes that prevent silent dishonesty.\nmetadata:\nopenrig:\nstage: factory-approved\nsibling_skills:\n- claude-compaction-restore\n- mental-model-ha\n- scope-recovery\n- session-compaction-and-restore\n- retiring-and-inheriting-a-seat\n- agent-startup-and-context-ingestion\n- agent-starters\n- composable-priming-packs\n- session-source-fork\n- claude-compact-in-place\n- pre-maintenance-agent-preservation</h2>\n<h1>Seat Continuity and Handover</h1>\n<p>A pair of primitive families that separate <em>who is sitting in a seat</em> from\n<em>what the seat itself is</em>:</p>\n<ol>\n<li><strong>Occupant-creation primitives</strong> — <code>resume</code>, <code>fork</code>, <code>rebuild</code>, <code>fresh</code> — produce a candidate new occupant. Answer: \"where did the new occupant come from?\"</li>\n<li><strong>Seat-binding primitives</strong> — <code>seat handover</code>, later <code>seat transfer</code> / <code>seat retire</code> / <code>seat swap</code> — bind a candidate occupant into the topology. Answer: \"what happened to the stable seat identity?\"</li>\n</ol>\n<p>Core architectural decision: <strong>stable seat identity, fluid occupant\nidentity, explicit provenance.</strong> Today's <code>lead2</code>/<code>lead3</code>/<code>lead4</code>/<code>lead5</code>\npattern encodes successor lineage into seat names — that's the wrong\nshape. Stable seat name + separately-recorded provenance trail is the\nright shape.</p>\n<h2>Use this when</h2>\n<ul>\n<li>Replacing a seat's occupant via rebuild, fork, fresh, or future seat-handover</li>\n<li>Choosing old-occupant disposition: retire / advise / shadow</li>\n<li>Reasoning about whether a seat's lineage is stable or has drifted</li>\n<li>Reading or writing the provenance record for a seat</li>\n<li>Designing or auditing topology stability across an occupant change</li>\n</ul>\n<h2>Don't use this when</h2>\n<ul>\n<li>The seat is freshly created (no occupant to replace) — use <code>rig launch</code> / <code>rig expand</code> directly</li>\n<li>The intent is to change topology shape (add/remove seats), not replace an occupant — use topology-mutation primitives</li>\n</ul>\n<h2>The two-outcome honesty model</h2>\n<p>Every seat-binding operation produces two <strong>independent</strong> outcomes:</p>\n<pre><code>continuityOutcome: rebuilt | resumed | forked | fresh | failed\nseatBindingOutcome: handed_over | partial | failed | unchanged\n</code></pre>\n<p>These can disagree honestly. Examples:</p>\n<ul>\n<li><code>continuityOutcome: failed</code> + <code>seatBindingOutcome: unchanged</code> — new occupant didn't materialize; seat correctly retains old occupant.</li>\n<li><code>continuityOutcome: rebuilt</code> + <code>seatBindingOutcome: failed</code> — candidate created OK; bind failed mid-flight; provenance records the gap.</li>\n</ul>\n<p><strong>Don't collapse these into one outcome.</strong> The system can describe what\nactually happened only if the two are recorded independently.</p>\n<h2>Provenance record (durable, queryable)</h2>\n<p>Every handover writes:</p>\n<ul>\n<li>seat id</li>\n<li>old occupant id</li>\n<li>new occupant id</li>\n<li>creation mode (<code>resume</code>/<code>fork</code>/<code>rebuild</code>/<code>fresh</code>)</li>\n<li>source artifacts used</li>\n<li>whether old occupant remains alive as advisor/shadow</li>\n<li>operator or loop that initiated the motion</li>\n<li>timestamp</li>\n<li>result (<code>handed_over</code> / <code>partial</code> / <code>failed</code>)</li>\n</ul>\n<p>This is the system's truth-source for \"how did the current occupant get\nthere.\" Without it, the control plane shows the current occupant but\nnot the legitimacy of the transition.</p>\n<h2>State models — independent</h2>\n<h3>Occupant-creation state (per candidate)</h3>\n<ol>\n<li><strong>Requested</strong> — input to rebuild/fork/fresh/resume</li>\n<li><strong>Realized</strong> — runtime/artifact path produced an occupant with managed-seat shape</li>\n<li><strong>Failed</strong> — candidate didn't materialize; <code>continuityOutcome: failed</code></li>\n</ol>\n<h3>Seat-binding state (per seat)</h3>\n<ol>\n<li><strong>Stable</strong> — current occupant attached, no in-flight binding</li>\n<li><strong>Binding</strong> — handover in progress</li>\n<li><strong>Bound</strong> — handover succeeded; provenance record written</li>\n<li><strong>Unchanged</strong> — bind failed before completion; seat retains old occupant</li>\n</ol>\n<p>A seat stays <code>Stable</code> even if multiple candidate-occupants were produced and discarded.</p>\n<h2>Failure modes (5)</h2>\n<ol>\n<li><strong>Candidate creation failed</strong> — <code>rebuild</code> couldn't synthesize from artifacts; <code>fork</code> couldn't resolve <code>session_source</code>; <code>fresh</code> couldn't launch. <strong>Action</strong>: bind operation does not begin; seat unchanged; provenance records the failed candidate-creation step.</li>\n<li><strong>Old occupant cannot be detached cleanly</strong> — runtime hung, tmux locked, etc. <strong>Action</strong>: bind halts mid-flight; seat enters <code>Binding</code> state with explicit \"halted\" sub-status; operator alerted. <strong>Do NOT auto-rollback by reattaching old-occupant if detach didn't complete cleanly.</strong></li>\n<li><strong>Bind succeeded but provenance write failed</strong> — disk/db error. <strong>Action</strong>: not durable until provenance writes; treat as <code>Binding</code> halted, not <code>Bound</code>.</li>\n<li><strong>Old occupant disposition unfulfillable</strong> — operator requested <code>advise</code> (keep alive as advisor) but runtime can't keep old alive. <strong>Action</strong>: degrade to <code>retire</code> with explicit notification, OR fail if operator passed strict-disposition flag.</li>\n<li><strong>Concurrent handover attempts</strong> — two operations target the same seat. <strong>Action</strong>: serialize by seat-id lock; second attempt refuses with clear error.</li>\n</ol>\n<h2>Hard boundaries (do-not list; verbatim)</h2>\n<ul>\n<li><strong>Do NOT collapse <code>rebuild</code> and <code>seat handover</code> into one primitive.</strong> The design specifically separates them so the system can describe what actually happened.</li>\n<li><strong>Do NOT introduce successor-suffix seat names</strong> (<code>lead2</code>/<code>lead3</code>). Stable seat identity is the architectural goal. <em>(Reconciliation: this governs the <strong>live</strong> seat address, which stays clean — the seat name is whoever sits now. A <strong>retired</strong> tenure IS versioned (<code>&lt;seat&gt;-vN</code>) as the separately-recorded provenance trail / cold wake-target — that is the lineage, not a live successor-suffix. See <code>retiring-and-inheriting-a-seat</code> and its lineage ledger.)</em></li>\n<li><strong>Do NOT report <code>seatBindingOutcome: handed_over</code></strong> if the provenance record didn't write durably.</li>\n<li><strong>Do NOT auto-rollback a half-completed handover</strong> by re-attaching the old occupant unless detach completed cleanly first.</li>\n</ul>\n<h2>Composition: seat handover over fork</h2>\n<p>Once <code>session_source</code> fork v1 lands (already shipped at openrig\n<code>c7b6df1</code>), the next composition is <strong>seat handover over fork</strong>:\ncandidate occupant created via fork, bound into the existing seat via\nhandover. Continuity outcome is <code>forked</code>; binding outcome is independent.</p>\n<h2>Currently shipped vs deferred</h2>\n<ul>\n<li><strong>Option A (rebuild) shipped</strong> at openrig <code>578bd5c</code> (2026-04-30): <code>session_source.mode: rebuild</code> with <code>ref.kind: artifact_set</code>; identity-honesty bedrock at 4 layers (schema dispatch, orchestrator threading, SQLite read-back, negative-grep on resolver output). 26/26 Tier 1 cases green; full daemon regression 2146/2146 PASS.</li>\n<li><strong>Option B partially shipped, partially deferred to Mode 3</strong>: the <code>rig seat handover</code> CLI exists as a planning/observability surface — <code>status &lt;seat&gt;</code> reads the seat-handover observability tables (migration <code>021</code>); <code>handover &lt;seat&gt;</code> plans a safe two-phase handover sequence with actual execution flowing through existing seat-launch surfaces under operator gating. Full code-direct <code>SeatHandoverService</code> daemon module + <code>seat-binding-outcome</code> provenance record + nodes-table provenance migration remain deferred to Mode 3. MVP composition <code>seat handover over fork</code> is highest-leverage v1.</li>\n</ul>\n<h2>Why load-bearing for RSI</h2>\n<p>Any recursive seat-refresh loop must be able to replace an occupant\nwhile keeping topology stable. Without these primitives, RSI loops will\neither accumulate suffixed seat names (lineage leaking into identity) or\ndestabilize topology references on each cycle. Provenance must be\ndurable AND queryable so RSI loops can decide whether a seat is fresh\nenough to receive new work or needs re-handover.</p>\n<h2>Discovery-registration gap (pilot-observed 2026-08-05)</h2>\n<p>A renamed / retired occupant (<code>&lt;seat&gt;-vN</code>, kept alive as a cold advisor) is intentionally <strong>absent from\nthe managed node registry</strong> — <code>rig ps</code>, discovery, and the delivery verbs (<code>walk</code> / <code>send</code>) cannot find\nit. This is by design (only bound occupants are registered), and it makes the <strong>lineage ledger +\nboot-captured session id the wake path</strong> (harness-level <code>--resume</code> / <code>codex exec</code>, not the rig registry).\nTwo live handovers confirmed this. See <code>retiring-and-inheriting-a-seat</code>.</p>\n<h2>See also</h2>\n<ul>\n<li><code>references/apprentice-successor-seat-cutover.md</code> — the portable mechanic SOP used only after the owner-worded gate</li>\n<li><code>references/orchestrator-role.md</code> — the orchestration judgment, authority, custody, and receipt contract</li>\n<li><code>references/apprentice-evidence-toolkit.md</code> — optional evidence apparatus selected only when the stakes earn it</li>\n<li><code>session-source-fork</code> skill — <code>fork</code> occupant-creation primitive (sibling)</li>\n<li><code>agent-starters</code> skill — composes occupant-creation + binding into named reusable starting points</li>\n<li><code>cross-host-rig-commands</code> skill — multi-host handover (deferred)</li>\n</ul>\n","files":[{"path":"references/apprentice-evidence-toolkit.md","sizeBytes":1619,"isText":true},{"path":"references/apprentice-successor-seat-cutover.md","sizeBytes":11198,"isText":true},{"path":"references/orchestrator-role.md","sizeBytes":2237,"isText":true},{"path":"SKILL.md","sizeBytes":8518,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-09-12T07:22:14.381387Z","sha256":"F91A02D1A027EB05F69DDEF482F69BA76A6421F4A4D27A951DEA3B025F96BF66","sizeBytes":10480},"review":null,"source":{"repositoryUrl":"https://github.com/mvschwarz/openrig","path":"packages/daemon/assets/plugins/openrig-core/skills/seat-continuity-and-handover","license":"Apache-2.0","commit":"b374dde300fd2a3cf1ee139b89b11e2fa3945784","subtreeSha":"48F8C830BCB3A053E0BFE9A7308419164B96157985C4A3493A73F51714B268E5","lastSyncedAt":"2026-09-25T06:48:47.236757Z"},"reviewedAt":"2026-09-12T07:23:32.858359Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/mvschwarz/openrig/tree/main/packages/daemon/assets/plugins/openrig-core/skills/seat-continuity-and-handover"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install mvschwarz-openrig@llmmart"},{"target":"git","command":"git clone https://github.com/mvschwarz/openrig.git"}]}